CVE-2012-4930
The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.
Key facts
- CVSS score
- 2.6 (v2.0)
- Severity
- LOW
- CVSS vector
AV:N/AC:H/Au:N/C:P/I:N/A:N- Weakness (CWE)
- CWE-310
- EPSS score
- 2.1% (82th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2012-4855)
- Published
- September 15, 2012
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2012-4855 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.
View on the EU Vulnerability DatabaseAffected products
- google / chrome
- mozilla / firefox
References
- http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/
- http://isecpartners.com/blog/2012/9/14/details-on-the-crime-attack.html
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html
- http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312
- http://www.ekoparty.org/2012/thai-duong.php
- http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091
- http://www.theregister.co.uk/2012/09/14/crime_tls_attack/
- https://bugzilla.redhat.com/show_bug.cgi?id=857737
- https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain